Splunk Search

finding percentage different between last week and week before?

abi2023
Path Finder

I have spl in splunk
index=demo 
search compliance= standard1 | timechart span=1week count by status 
| add totals row=t enable not_enable fieldname= "total"
| eval percentage = round((enable / total ) * 100 , 0) . " %"
| reverse 
| table _time percentage 

above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row?
If week before is 56% percentage and last week percentage 70% it need show next last week row 14% 
how can I do this? I try join append it did not work for me.
Thanks in advance

Labels (3)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...